dependabot-composer 0.98.20 → 0.98.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc9c9411db31c5a0909114958fbc6509c5dcd50a38bb72892387fc2046f46fee
-  data.tar.gz: 506f2874b20f196a3896253138b36fbefe8c7075d9b1cdf9a6e42a2465392d17
+  metadata.gz: c73cf36b54b1e218f255692bd1f9c2229baede4a4391712cf1d1fb2f9214350b
+  data.tar.gz: 8e884ba768c2826249e9ca5db79800efa2797258a5a11634d30b9c06f4655dbc
 SHA512:
-  metadata.gz: c909e36e277a4d641389ffb69eb1ffec4aa2dca471103cc9193d9a9e027bc993453105c7dba1ec5609cd1ad758c50ba75f8c0cf9c36421b3ece9deec52a17612
-  data.tar.gz: 8f8f904cb952c5490770a977a62975a1a087373052221e41e17ec640d1f43afa35842876323d6457b51349fa446f63c2d95295f23c4fc0096373c39acdbb9c79
+  metadata.gz: 3700198c7dd632aa35015a934210bedef7fc8344a1c1249a5fac28a08c20e4f0c15da52c87417d1fb5fe63af3072dcdf5654d6ae17b9a8820f7bc2df3e39341b
+  data.tar.gz: b8588ac2b752da94dad8de876bec08be43d8828e35c5ad26a6c74568e5c61078555b1258c76366be1b6d7df1ce9d6b9803fd2be6e878067df7ad27b1a7cbbcbf

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "shellwords"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/composer/file_updater"
@@ -54,6 +53,7 @@ module Dependabot
           SharedHelpers.with_git_configured(credentials: credentials) do
             SharedHelpers.run_helper_subprocess(
               command: "php -d memory_limit=-1 #{php_helper_path}",
+              escape_command_str: false,
               function: "update",
               env: credentials_env,
               args: [
@@ -78,10 +78,10 @@ module Dependabot
           error.message.include?("Content-Length mismatch")
         end
 
-        # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/CyclomaticComplexity
         # rubocop:disable Metrics/MethodLength
+        # rubocop:disable Metrics/PerceivedComplexity
         def handle_composer_errors(error)
           if error.message.start_with?("Failed to execute git checkout")
             raise git_dependency_reference_error(error)
@@ -130,10 +130,10 @@ module Dependabot
 
           raise error
         end
-        # rubocop:enable Metrics/PerceivedComplexity
         # rubocop:enable Metrics/AbcSize
         # rubocop:enable Metrics/CyclomaticComplexity
         # rubocop:enable Metrics/MethodLength
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def write_temporary_dependency_files
           path_dependencies.each do |file|
@@ -224,7 +224,7 @@ module Dependabot
 
             content_hash =
               SharedHelpers.run_helper_subprocess(
-                command: Shellwords.join(["php", php_helper_path]),
+                command: "php #{php_helper_path}",
                 function: "get_content_hash",
                 env: credentials_env,
                 args: [Dir.pwd]

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -66,6 +66,7 @@ module Dependabot
           SharedHelpers.with_git_configured(credentials: credentials) do
             SharedHelpers.run_helper_subprocess(
               command: "php -d memory_limit=-1 #{php_helper_path}",
+              escape_command_str: false,
               function: "get_latest_resolvable_version",
               args: [
                 Dir.pwd,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.98.20
+  version: 0.98.21
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.20
+        version: 0.98.21
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.20
+        version: 0.98.21
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement